Debian Bug report logs - #621726
krb5-admin-server: kadmind dies after nmap -sV

version graph

Package: krb5-admin-server; Maintainer for krb5-admin-server is Sam Hartman <hartmans@debian.org>; Source for krb5-admin-server is src:krb5 (PTS, buildd, popcon).

Reported by: Felipe Ortega <ortegaga@gmail.com>

Date: Fri, 8 Apr 2011 09:29:05 UTC

Severity: important

Tags: confirmed, fixed-upstream, security, upstream

Merged with 622681

Found in version krb5/1.8.3+dfsg-4

Fixed in versions krb5/1.9.1+dfsg-1, krb5/1.8.3+dfsg-4squeeze1

Done: Sam Hartman <hartmans@debian.org>

Bug is archived. No further changes may be made.

Forwarded to http://krbdev.mit.edu/rt/Ticket/Display.html?id=6899

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, ortegaga@gmail.com, Sam Hartman <hartmans@debian.org>:
Bug#621726; Package krb5-admin-server. (Fri, 08 Apr 2011 09:29:10 GMT) (full text, mbox, link).


Acknowledgement sent to Felipe Ortega <ortegaga@gmail.com>:
New Bug report received and forwarded. Copy sent to ortegaga@gmail.com, Sam Hartman <hartmans@debian.org>. (Fri, 08 Apr 2011 09:29:20 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Felipe Ortega <ortegaga@gmail.com>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: krb5-admin-server: kadmind dies after nmap -sV
Date: Fri, 08 Apr 2011 11:27:15 +0200
[Message part 1 (text/plain, inline)]
Package: krb5-admin-server
Version: 1.8.3+dfsg-4
Severity: important


After executing a command like this:

# nmap -n -sV krb01

where krb01 is the main kerberos server (krb5kdc and kadmind running), kadmind dies silently.

I suppose nmap sends some string when trying to guess the version of the program running, and
kadmind can't parse it.

Someone could use such a tool, or inject the malformed string directly, causing a DoS.

Attached is an strace output of the kadmind process while runing nmap against the server.

-- System Information:
Debian Release: 6.0.1
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.32-5-amd64 (SMP w/1 CPU core)
Locale: LANG=es_ES.UTF-8, LC_CTYPE=es_ES.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages krb5-admin-server depends on:
ii  debconf [debconf-2.0]   1.5.36.1         Debian configuration management sy
ii  krb5-kdc                1.8.3+dfsg-4     MIT Kerberos key server (KDC)
ii  libc6                   2.11.2-10        Embedded GNU C Library: Shared lib
ii  libcomerr2              1.41.12-2        common error description library
ii  libgssapi-krb5-2        1.8.3+dfsg-4     MIT Kerberos runtime libraries - k
ii  libgssrpc4              1.8.3+dfsg-4     MIT Kerberos runtime libraries - G
ii  libk5crypto3            1.8.3+dfsg-4     MIT Kerberos runtime libraries - C
ii  libkadm5srv-mit7        1.8.3+dfsg-4     MIT Kerberos runtime libraries - K
ii  libkdb5-4               1.8.3+dfsg-4     MIT Kerberos runtime libraries - K
ii  libkeyutils1            1.4-1            Linux Key Management Utilities (li
ii  libkrb5-3               1.8.3+dfsg-4     MIT Kerberos runtime libraries
ii  libkrb5support0         1.8.3+dfsg-4     MIT Kerberos runtime libraries - S
ii  libss2                  1.41.12-2        command-line interface parsing lib
ii  lsb-base                3.2-23.2squeeze1 Linux Standard Base 3.2 init scrip

krb5-admin-server recommends no packages.

krb5-admin-server suggests no packages.

-- debconf information:
  krb5-admin-server/kadmind: true
* krb5-admin-server/newrealm:
[nmap_kadmind_strace.txt (text/plain, attachment)]

Set Bug forwarded-to-address to 'http://krbdev.mit.edu/rt/Ticket/Display.html?id=6899'. Request was from Sam Hartman <hartmans@debian.org> to control@bugs.debian.org. (Fri, 08 Apr 2011 13:14:33 GMT) (full text, mbox, link).


Information forwarded to debian-bugs-dist@lists.debian.org:
Bug#621726; Package krb5-admin-server. (Fri, 08 Apr 2011 13:17:13 GMT) (full text, mbox, link).


Acknowledgement sent to Sam Hartman <hartmans@debian.org>:
Extra info received and forwarded to list. (Fri, 08 Apr 2011 13:17:22 GMT) (full text, mbox, link).


Message #12 received at submit@bugs.debian.org (full text, mbox, reply):

From: Sam Hartman <hartmans@debian.org>
To: Felipe Ortega <ortegaga@gmail.com>
Cc: 621726@bugs.debian.org, Debian Bug Tracking System <submit@bugs.debian.org>
Subject: Re: Bug#621726: krb5-admin-server: kadmind dies after nmap -sV
Date: Fri, 08 Apr 2011 08:38:23 -0400
tags 621726 confirmed security upstream
thanks

I guess it's good that I'm in the middle of a patch release for krb5
denial of service issues or something.
Thanks for the report and sorry about the embarrassment.
Reported upstream




Information forwarded to debian-bugs-dist@lists.debian.org:
Bug#621726; Package krb5-admin-server. (Fri, 08 Apr 2011 13:17:32 GMT) (full text, mbox, link).


Acknowledgement sent to Sam Hartman <hartmans@debian.org>:
Extra info received and forwarded to list. (Fri, 08 Apr 2011 13:17:38 GMT) (full text, mbox, link).


Added tag(s) upstream, confirmed, and security. Request was from Sam Hartman <hartmans@debian.org> to control@bugs.debian.org. (Fri, 08 Apr 2011 13:22:06 GMT) (full text, mbox, link).


Information forwarded to debian-bugs-dist@lists.debian.org, Sam Hartman <hartmans@debian.org>:
Bug#621726; Package krb5-admin-server. (Wed, 13 Apr 2011 19:03:12 GMT) (full text, mbox, link).


Acknowledgement sent to Tom Yu <tlyu@MIT.EDU>:
Extra info received and forwarded to list. Copy sent to Sam Hartman <hartmans@debian.org>. (Wed, 13 Apr 2011 19:03:12 GMT) (full text, mbox, link).


Message #24 received at 621726@bugs.debian.org (full text, mbox, reply):

From: Tom Yu <tlyu@MIT.EDU>
To: 621726@bugs.debian.org
Cc: control@bugs.debian.org
Subject: fixed upstream
Date: Wed, 13 Apr 2011 14:53:23 -0400
tags 621726 + fixed-upstream
thanks

Fix committed upstream and advisory published.

http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-004.txt




Added tag(s) fixed-upstream. Request was from Tom Yu <tlyu@MIT.EDU> to control@bugs.debian.org. (Wed, 13 Apr 2011 19:03:13 GMT) (full text, mbox, link).


Merged 621726 622681. Request was from Tom Yu <tlyu@MIT.EDU> to control@bugs.debian.org. (Wed, 13 Apr 2011 19:39:17 GMT) (full text, mbox, link).


Added tag(s) pending. Request was from Sam Hartman <hartmans@debian.org> to control@bugs.debian.org. (Thu, 02 Jun 2011 15:09:05 GMT) (full text, mbox, link).


Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Tue, 12 Jul 2011 07:36:19 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sat Apr 19 05:20:50 2025; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU General Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.